Security tools often report “DMARC policy not enabled” when a domain publishes DMARC with p=none. The record exists, but it is asking receivers to monitor rather than quarantine or reject messages that fail DMARC.
That is different from having no DMARC record at all. p=none is a valid DMARC policy and can be an intentional first stage while a domain owner learns which services send legitimate mail.
A p=none policy allows DMARC evaluation and reporting without asking receivers to enforce quarantine or rejection. It is useful for observing the current state before stronger policy is introduced.
Because failing messages are not subject to an enforcement request from the domain, scanners may describe this as a policy that is present but not enforced.
p=quarantine asks receiving systems to treat DMARC-failing mail with suspicion. p=reject asks them to reject failing mail. These stronger policies can reduce direct domain spoofing when legitimate senders are correctly authenticated and aligned.
A staged rollout matters because business domains often send through Microsoft 365 or Google Workspace plus CRM, marketing, invoicing, support and other SaaS platforms. Moving directly to p=reject before identifying those senders can affect legitimate delivery.
A safer process inventories authorised senders, checks SPF and DKIM alignment, reviews authentication data, resolves legitimate gaps, and then tightens policy deliberately. The pace should reflect the organisation's mail complexity and risk tolerance.
An external scanner can see the public DMARC policy, but it cannot infer every legitimate internal or third-party mail flow from DNS alone. Enforcement is a change-control decision that should be made by someone who understands the organisation's authorised senders.
Use the matching ScoutLab checker with only a domain name. No signup or email address is required.
ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.
Run the free website security checkYes. p=none is a valid monitoring policy. It enables DMARC evaluation and reporting but does not ask receivers to quarantine or reject failing messages. It is commonly used while a domain owner validates legitimate sending sources.
Not blindly. A staged move is safer because legitimate third-party senders can be disrupted if they are not authenticated and aligned correctly. Inventory authorised senders and validate their SPF or DKIM alignment before stronger enforcement.
A scanner can flag p=none because the domain is monitoring DMARC failures without requesting enforcement. That is useful context for risk assessment, but the right next policy depends on whether legitimate mail flows have been validated.
SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.
